---
id: "CVE-2026-115484"
kind: "vulnerability"
aliases: ["CVE-2026-115484"]
title: "open-iscsi iscsiuio: DHCP option parsing over-reads heap, crashes daemon"
severity: "high"
cvss: 7.6
epss: 0.00221
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "open-iscsi", "fixed": [], "affected": "all versions through current master (a65ce4b), including 2.1.13", "ecosystem": "vendor"}, {"name": "iscsi-initiator-utils (Red Hat Enterprise Linux 7-10)", "fixed": [], "affected": "RHEL 7, 8, 9, 10", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bnx2", "infrastructure", "iscsi", "linux", "open-iscsi", "qedi", "rhel", "self-hosted"]
not_affected_if: ["no-iscsiuio", "no-offload-hardware", "software-iscsi-only", "static-ip"]
published_at: "2026-10-23T01:16:53+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:16:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115484", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115484", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:16:19+00:00"}]
---

# open-iscsi iscsiuio: DHCP option parsing over-reads heap, crashes daemon

The iscsiuio daemon in open-iscsi miscalculates the length of DHCPv4 option data and reads past its heap buffer. A crafted DHCP response from the same network segment can crash the daemon or corrupt its network configuration.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:open-iscsi affected all versions through current master (a65ce4b), including 2.1.13 fixed ?
- vendor:iscsi-initiator-utils (Red Hat Enterprise Linux 7-10) affected RHEL 7, 8, 9, 10 fixed ?

## How to check

- Check for hardware offload: lspci | grep -Ei 'bnx2|qlogic|qedi' (Broadcom bnx2/bnx2x or QLogic qedi NICs)
- Check whether iscsiuio is installed/running: systemctl status iscsiuio.socket iscsiuio.service
- Check whether the iSCSI iface uses DHCP: iscsiadm -m iface (and the iscsiuio IPv4 config is DHCP)
- Package version: rpm -q iscsi-initiator-utils or dpkg -l open-iscsi

## Fix

No fixed version exists as of 2026-10-25 (upstream open-iscsi master and 2.1.13 still vulnerable; Debian unfixed; Red Hat RHEL 7-10 affected, no errata). Upstream fix proposed in the bugzilla: pass uip_datalen - DHCP_MSG_LEN - 4 to parse_options in parse_msg(). Mitigate: use static IPs for iSCSI boot, or restrict the L2 segment and DHCP/BOOTP traffic to trusted hosts.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115484
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115484
- 2026-10-25T03:16:19+00:00 analyst — Red Hat advisory+bugzilla 2556265: no upstream fix as of master a65ce4b; distinct from CVE-2026-18728 (fixed in 2.1.13). Debian lists unfixed incl. 2.1.13-1. Red Hat rates Moderate; only hardware iSCSI offload NICs (bnx2/bnx2x, qedi) with DHCPv4.

## Documents

- [advisory] Red Hat CVE-2026-115484 https://access.redhat.com/security/cve/CVE-2026-115484
- [describes] Red Hat Bugzilla 2556265: iscsiuio parse_msg OOB read https://bugzilla.redhat.com/show_bug.cgi?id=2556265
- [mentions] Debian tracker CVE-2026-115484 (unfixed) https://security-tracker.debian.org/tracker/CVE-2026-115484

## From the sources

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_